{"id":"CVE-2026-119325","kind":"vulnerability","aliases":["CVE-2026-119325"],"related":[],"title":"Bricks theme: unauthenticated visitors can read unpublished WordPress page content","description":"Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.","summary":"The Bricks WordPress theme (version 2.4 and earlier) exposes a REST endpoint, load_popup_content, that returns content without checking whether the page is published or whether the caller may see it. An anonymous attacker can read draft and unpublished page content by iterating the popupId parameter.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bricks-theme","package","self-hosted","wordpress"],"not_affected_if":["bricks-not-installed","newer-version"],"how_to_check":"- Check the installed Bricks theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Request `/wp-json/bricks/v1/load_popup_content` on the site and see whether it responds to anonymous requests.","fix":"- Bricks theme: a version later than `2.4` (the sources do not name the fixed version).","status":"open","published_at":"2026-10-29T21:17:21+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","triaged_at":"2026-10-29T21:28:34+00:00","updated_at":"2026-10-29T21:28:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T21:28:34Z","model":"claude-haiku-5-5","output":{"fix":"- Bricks theme: a version later than `2.4` (the sources do not name the fixed version).","reach":"internet","title":"Bricks theme: unauthenticated visitors can read unpublished WordPress page content","impact":"medium","summary":"The Bricks WordPress theme (version 2.4 and earlier) exposes a REST endpoint, load_popup_content, that returns content without checking whether the page is published or whether the caller may see it. An anonymous attacker can read draft and unpublished page content by iterating the popupId parameter.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","bricks-theme","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"anonymous visitors read unpublished draft page content","analyst_note":"Confirm the fixed Bricks version and whether the nonce step is required; the NVD entry is the only source given.","how_to_check":"- Check the installed Bricks theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Request `/wp-json/bricks/v1/load_popup_content` on the site and see whether it responds to anonymous requests.","plain_action":"","needs_analyst":true,"not_affected_if":["bricks-not-installed","newer-version"],"who_is_affected":"Sites running the Bricks theme at version 2.4 or earlier on WordPress are exposed through the public REST endpoint. Any unpublished or draft page on such a site can be read without logging in. Sites not using Bricks, or running a newer version, are not affected by this report.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4210,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119325':13A,16A '-2026':12A,15A '/wp-json/bricks/v1/load_popup_content':138C '2.4':30B,74C 'access':83C 'action':127C 'allow':94C 'anonym':58B,95C 'attack':59B,96C,115C 'brick':1A,18B,26B,72C,123C 'bricks-them':17B 'broken':82C 'caller':53B 'capabl':113C 'check':44B,114C 'confidenti':144C 'contain':79C 'content':10A,39B,42B,66B,90C,103C,145C 'control':84C 'cve':11A,14A 'disclos':143C 'draft':62B,99C 'earlier':32B 'endpoint':36B,92C,139C 'enumer':141C 'expos':33B 'host':23B 'increment':130C 'iter':68B 'load':37B,88C 'may':54B 'nonc':120C,126C 'obtain':117C 'packag':20B 'page':9A,47B,65B,102C 'paramet':71B,108C 'popup':38B,89C 'popupid':70B,107C,132C 'post':149C 'public':119C 'publish':49B 'queri':125C 'read':6A,61B,98C 'regener':124C 'request':135C 'rest':35B,91C 'return':41B 'see':55B 'self':22B 'self-host':21B 'site':152C 'status':111C 'suppli':105C 'theme':2A,19B,28B,73C 'unauthent':3A,81C 'unpublish':7A,64B,101C,148C 'valu':133C 'version':29B 'via':121C 'visitor':4A 'vulner':85C 'whether':45B,51B 'without':43B,109C 'wordpress':8A,24B,27B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Bricks theme at version 2.4 or earlier on WordPress are exposed through the public REST endpoint. Any unpublished or draft page on such a site can be read without logging in. Sites not using Bricks, or running a newer version, are not affected by this report.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T21:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119325","severity":null,"published_at":"2026-10-29T21:17:21+00:00","modified_at":"2026-10-29T21:17:21+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","fetched_at":"2026-10-29T21:26:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}